npm v3.0.0-alpha.4

npm v3.0.0-alpha.4 - 2026.09.22

FDC3 v3.0.0-alpha.4 represents a significant step towards release readiness for FDC3 3.0.0, with a strong focus on specification refinement, conformance maturity, implementation quality, documentation improvements, and project hardening.

This release substantially expands conformance coverage across the FDC3 API surface, adding new tests for version reporting, optional features, channel management, event listeners, context clearing, error handling, and desktop agent behaviors. Alongside this, a number of conformance test fixes and stability improvements were delivered to improve interoperability validation and implementation confidence.

The specification and related standards work continued to mature, with clarifications and enhancements across App Directory, DACP and Core FDC3 APIs. Several deprecated elements were removed, API behavior was clarified, and targeted enhancements were introduced, including improvements to intent handling, context metadata support, channel event semantics, and listener registration capabilities.

Significant effort was also invested in release engineering, security, and supply chain resilience. The project migrated to CodeQL, strengthened CI/CD workflows, expanded vulnerability scanning coverage, introduced additional dependency auditing, remediated security findings, and completed a large-scale dependency modernization effort across the codebase and website.

Additional work focused on ecosystem readiness, including updated language support, implementation fixes, refreshed examples, improved developer documentation, and enhanced guidance for web implementations and adoption of FDC3 v3 capabilities.

Finally, this release reflects healthy community growth, with multiple first-time contributors helping improve conformance, implementations, documentation, and project quality as we continue progressing toward the FDC3 3.0.0 general availability release.

What's Changed since v3.0.0-alpha.2

• test(conformance): add optionalFeatures coverage from getInfo() (Refs #1776) by @ninjabot92 in #1888
• Remove deprecated name and customConfig from AppD specification (#1937) by @ninjabot92 in #1944
• chore: switch SAST from semgrep to CodeQL and update Node workflows t… by @Mankurj05 in #1868
• Bump dompurify from 3.4.10 to 3.4.11 in /website by @dependabot[bot] in #1939
• Fix an issue in conformance test AOpensBWithWrongContext by @kriswest in #1933
• Harden CI workflows and remediate supply-chain security findings by @kriswest in #1948
• chore(deps)(deps): bump @cucumber/pretty-formatter from 1.0.1 to 4.0.0 by @dependabot[bot] in #1954
• fix(workbench): update FDC3 context examples by @LarryHu0217 in #1949
• chore(deps)(deps): bump @cucumber/cucumber from 10.3.1 to 13.0.0 by @dependabot[bot] in #1959
• Bump websocket-driver from 0.7.4 to 0.7.5 in /website by @dependabot[bot] in #1985
• Replace glue42 finsemble with interop.io in FDC3 Conformance page by @toni-ppet in #1979
• fix(web-impl): gate channel changed events by @LarryHu0217 in #1978
• chore(deps)(deps): bump is-ci from 2.0.0 to 4.1.0 by @dependabot[bot] in #1960
• test(conformance): check FDC3 version from getInfo by @LarryHu0217 in #1966
• test(conformance): cover channel error cases by @LarryHu0217 in #1982
• chore: update GitHub Actions to latest versions by @kriswest in #1990
• test(conformance): cover destructured desktop agent methods by @LarryHu0217 in #1976
• docs: clarify userChannelChanged after joinUserChannel by @LarryHu0217 in #1967
• test(conformance): gate user channel membership APIs by @LarryHu0217 in #1975
• fix(get-agent): reduce normal discovery log noise by @LarryHu0217 in #1977
• chore(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 in /website by @dependabot[bot] in #1996
• chore(deps)(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 by @dependabot[bot] in #1998
• chore(deps)(deps): bump body-parser from 1.20.5 to 1.20.6 by @dependabot[bot] in #1994
• chore(deps-dev): bump webpack-dev-server from 5.2.5 to 5.2.6 in /website by @dependabot[bot] in #1997
• chore: migrate CVE scanning to auditjs guide by @kriswest in #1992
• chore(deps): bump dompurify from 3.4.11 to 3.4.12 in /website by @dependabot[bot] in #2002
• chore(deps-dev): bump svgo from 3.3.3 to 3.3.4 in /website by @dependabot[bot] in #2003
• chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 in /website by @dependabot[bot] in #2004
• chore(deps)(deps): bump fast-uri from 3.1.2 to 3.1.4 by @dependabot[bot] in #2005
• chore: upgrade Node to 24.18.0 and fix fast-uri resolution by @kriswest in #2007
• chore(deps)(deps-dev): bump the minor-and-patch group in /website with 6 updates by @dependabot[bot] in #2010
• chore(deps)(deps): bump the minor-and-patch group across 1 directory with 16 updates by @dependabot[bot] in #2000
• fix conformance tests by @Roaders in #2009
• chore: fix website build, resolve CVEs, by @kriswest in #2021
• fix: improve CVE scan coverage and reduce API token usage by @kriswest in #2006
• chore(deps)(deps): bump fast-uri from 3.1.4 to 3.1.5 by @dependabot[bot] in #2051
• chore(deps)(deps): bump socket.io-parser from 4.2.6 to 4.2.7 by @dependabot[bot] in #2049
• chore(deps)(deps): bump undici from 7.28.0 to 7.29.0 by @dependabot[bot] in #2047
• ci(deps)(deps): bump the actions-minor-and-patch group across 1 directory with 5 updates by @dependabot[bot] in #2044
• chore(deps)(deps-dev): bump fast-uri from 3.1.4 to 3.1.5 in /website by @dependabot[bot] in #2050
• chore(deps)(deps-dev): bump js-yaml from 4.3.0 to 5.2.1 in /website by @dependabot[bot] in #2019
• chore(deps)(deps-dev): bump web-vitals from 1.1.2 to 6.0.1 by @dependabot[bot] in #1956
• chore(deps)(deps-dev): bump @mui/lab from 5.0.0-alpha.177 to 6.0.0-dev.20240529-082515-213b5e33ab by @dependabot[bot] in #1957
• chore(deps)(deps-dev): bump the react group across 1 directory with 2 updates by @dependabot[bot] in #2033
• chore(deps)(deps-dev): bump rimraf from 5.0.0 to 6.1.3 in /website by @dependabot[bot] in #2016
• chore(deps)(deps-dev): bump js-yaml from 5.2.1 to 5.2.2 in /website by @dependabot[bot] in #2060
• ci(deps)(deps): bump the actions-minor-and-patch group with 4 updates by @dependabot[bot] in #2055
• chore(deps)(deps-dev): bump clsx from 1.2.1 to 2.1.1 in /website by @dependabot[bot] in #2017
• chore(deps)(deps): bump mermaid from 11.15.0 to 11.16.1 in /website by @dependabot[bot] in #2058
• Document Vitest UI reporter usage by @julianna-ciq in #2061
• chore(deps)(deps-dev): bump fs-extra from 11.3.6 to 11.4.0 in /website in the minor-and-patch group by @dependabot[bot] in #2068
• Remove unused FDC3 security dependency by @julianna-ciq in #2066
• chore(deps)(deps): bump dompurify from 3.4.12 to 3.4.13 in /website by @dependabot[bot] in #2082
• chore(deps)(deps-dev): bump @mermaid-js/layout-elk from 0.1.9 to 0.2.2 in /website in the docusaurus group across 1 directory by @dependabot[bot] in #2031
• Remove unused CommonJS build dependency by @julianna-ciq in #2069
• Remove unused agent proxy dependencies by @julianna-ciq in #2067
• Clean up web implementation dependencies by @julianna-ciq in #2079
• Remove unused web demo dependencies by @julianna-ciq in #2078
• Remove unused example app dependencies by @julianna-ciq in #2077
• Remove unused conformance dependencies by @julianna-ciq in #2076
• Clean up shared testing dependencies by @julianna-ciq in #2075
• Remove unused standard dependencies by @julianna-ciq in #2074
• Remove unused schema tslib dependency by @julianna-ciq in #2072
• Remove unused context tslib dependency by @julianna-ciq in #2070
• Remove unused get-agent dependencies by @julianna-ciq in #2071
• chore(deps): update testing dependencies and resolve vulnerabilities by @kriswest in #2064
• chore(deps)(deps-dev): bump js-yaml from 5.2.2 to 5.2.3 in /website in the minor-and-patch group by @dependabot[bot] in #2084
• ci(deps)(deps): bump the actions-minor-and-patch group with 4 updates by @dependabot[bot] in #2086
• Documentation improvements (Types/Metadata merge, getAgent, context clarifications, broken links) by @kriswest in #2029
• Run Sonatype CVE audit nightly by @julianna-ciq in #2088
• Clean up security dependencies by @julianna-ciq in #2073
• Request for Chris Watson to become an FDC3 maintainer by @SeeWhatsOn in #1968
• Adopt TypeScript 7 in compatible workspaces by @julianna-ciq in #2065
• Remove unused workbench dependencies by @julianna-ciq in #2080
• Clarify channel event types by @julianna-ciq in #2052
• Bump jsdom to 30.0.1 by @julianna-ciq in #2063
• Adding golang support for the v3 updates by @kemerava in #2041
• chore(deps)(deps): bump syncpack from 14.3.1 to 15.3.2 by @dependabot[bot] in #2024
• chore(deps)(deps): bump the minor-and-patch group across 1 directory with 7 updates by @dependabot[bot] in #2093
• ci(deps)(deps): bump the actions-minor-and-patch group across 1 directory with 5 updates by @dependabot[bot] in #2090
• chore(deps)(deps): bump canonicalize from 2.1.0 to 3.0.0 by @dependabot[bot] in #2105
• Add dependency check baseline by @julianna-ciq in #2059
• Remove deprecated v1 AppD specification by @julianna-ciq in #2096
• Add channel ID to context cleared event by @julianna-ciq in #2043
• Add ContextWithMetadata to IntentResult by @julianna-ciq in #2020
• chore(deps)(deps-dev): bump cross-env from 7.0.3 to 10.1.0 in /website by @dependabot[bot] in #2011
• chore(deps)(deps-dev): bump postcss from 8.5.15 to 8.5.26 in /website by @dependabot[bot] in #2054
• chore(deps)(deps): bump the minor-and-patch group across 1 directory with 3 updates by @dependabot[bot] in #2116
• Bump Jest dependencies by @julianna-ciq in #2112
• chore(deps)(deps): bump @types/uuid from 10.0.0 to 11.0.0 by @dependabot[bot] in #2108
• chore(deps)(deps): bump the minor-and-patch group across 1 directory with 2 updates by @dependabot[bot] in #2126
• ci(deps)(deps): bump step-security/harden-runner from 2.20.0 to 2.20.1 in the actions-minor-and-patch group by @dependabot[bot] in #2125
• chore(deps)(deps): bump express and @types/express by @dependabot[bot] in #2124
• chore(deps)(deps-dev): bump del-cli from 5.0.0 to 7.0.0 in /website by @dependabot[bot] in #2014
• chore(deps)(deps): bump the minor-and-patch group with 2 updates by @dependabot[bot] in #2128
• chore(deps)(deps-dev): bump terser from 5.49.2 to 5.50.0 in the minor-and-patch group by @dependabot[bot] in #2134
• Bump remaining fdc3-conformance dependencies by @julianna-ciq in #2113
• chore(deps)(deps-dev): bump @types/node from 20.19.43 to 26.2.0 by @dependabot[bot] in #2131
• chore(deps)(deps): bump dotenv from 16.6.1 to 17.4.2 by @dependabot[bot] in #2119
• chore(deps)(deps-dev): bump globals from 15.15.0 to 17.9.0 by @dependabot[bot] in #2139
• chore(deps)(deps-dev): bump @eslint/compat from 1.4.1 to 2.1.0 by @dependabot[bot] in #2137
• chore(deps)(deps-dev): bump lint-staged from 15.5.2 to 17.3.0 by @dependabot[bot] in #2138
• ci(deps)(deps): bump the actions-minor-and-patch group with 4 updates by @dependabot[bot] in #2142
• ci(deps)(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 in the actions-minor-and-patch group by @dependabot[bot] in #2148
• chore(deps)(deps-dev): bump color from 4.2.3 to 5.0.3 by @dependabot[bot] in #2146
• chore(deps)(deps-dev): bump eslint-config-prettier from 9.1.2 to 10.1.8 by @dependabot[bot] in #2147
• chore(deps)(deps-dev): bump ts-morph from 24.0.0 to 28.0.0 by @dependabot[bot] in #2141
• Add newInstance parameter to raiseIntent and raiseIntentForContext by @Roaders in #1942
• Fix intermittent failures in fdc3.destructuredMethods conformance tests by @Roaders in #2143
• chore(deps)(deps-dev): bump the minor-and-patch group across 1 directory with 2 updates by @dependabot[bot] in #2151
• Fix fdc3-context typegen to resolve AppIdentifier ref locally by @Roaders in #2156
• Add basic addEventListener conformance tests by @julianna-ciq in #2154
• chore(deps): separate CVE and evergreening updates in Dependabot by @kriswest in #2185
• Bump ESLint to 10.8.1 and address new lint errors by @julianna-ciq in #2127
• Make raiseIntent context argument optional by @Roaders in #1983
• chore(deps)(deps): bump the security group across 1 directory with 5 updates by @dependabot[bot] in #2189
• chore(deps)(deps): bump the minor-and-patch group across 1 directory with 18 updates by @dependabot[bot] in #2191
• ci(deps)(deps): bump the actions-minor-and-patch group across 1 directory with 5 updates by @dependabot[bot] in #2177
• fix(example-apps): add trace ID to fallback metadata by @julianna-ciq in #2202
• chore(deps)(deps): bump express-rate-limit from 7.5.1 to 8.7.0 by @dependabot[bot] in #2208
• Remove FDC3 Identity & Security Working Group meeting by @Yannick-Malins in #2200
• Update MAINTAINERS.md to remove Yannick Malins by @Yannick-Malins in #2201
• Test omitted metadata in proxy requests by @julianna-ciq in #2215
• chore(deps)(deps-dev): bump the linting group across 1 directory with 2 updates by @dependabot[bot] in #2220
• feat(dacp): contextCleared listener registration, context-clearing docs & conformance tests (#2164, #2165, #2187) by @kriswest in #2193
• fix(dacp): clarify and align optional AppProvidableContextMetadata in request payloads (#2163) by @kriswest in #2198
• chore(deps)(deps-dev): bump typescript-eslint from 8.69.0 to 8.70.0 in the linting group by @dependabot[bot] in #2222
• fix(fdc3-conformance): fix pre-existing type errors and enable typecheck by @jabrailkhalil in #2199
• Clarify open timeout behavior when context is provided by @julianna-ciq in #2219
• fix(conformance): surface TypeScript type errors in fdc3-conformance build by @sandeep780049 in #2195
• ci(deps)(deps): bump the actions-minor-and-patch group with 4 updates by @dependabot[bot] in #2227
• fix(dacp): enforce getCurrentContextResponse context/metadata invariant (#2166) by @kriswest in #2197
• Add optional FDC3 version property to AppD record by @julianna-ciq in #1965
• chore: enforce LF line endings with Git attributes by @julianna-ciq in #2224
• docs: add FDC3 v3 web guidance for route-scoped identity, context-only apps, and private context types by @robmoffat with @Copilot in #1969
• fdc3.addContextListener() accepts array type by @kemerava in #1810
• fix(web-impl): decouple heartbeat timeouts by @emerardd in #2030
• Document changelog entry ordering for agents by @julianna-ciq in #2230
• Add changelog entry for PR #1965 by @julianna-ciq in #2229
• Cucumber testing steps port by @robmoffat in #1890

New Contributors

• @ninjabot92 made their first contribution in #1888
• @LarryHu0217 made their first contribution in #1949
• @toni-ppet made their first contribution in #1979
• @jabrailkhalil made their first contribution in #2199
• @sandeep780049 made their first contribution in #2195
• @robmoffat with @Copilot made their first contribution in #1969
• @emerardd made their first contribution in #2030

Full Changelog: v3.0.0-alpha.2...v3.0.0-alpha.4